A presigned URL holder could attach arbitrary x-amz-* headers to a PUT
request (e.g. x-amz-tagging, x-amz-acl, x-amz-storage-class,
x-amz-server-side-encryption*, x-amz-object-lock-*, x-amz-meta-*,
x-amz-website-redirect-location, x-amz-grant-*). Because only the
headers declared in SignedHeaders participate in signature
verification, the added headers bypass authentication; the PUT handler
then persists them into the object's Extended metadata.
Match the AWS SigV4 rule: every x-amz-* header present in the request
must appear in SignedHeaders. Exempt x-amz-content-sha256 (already
tamper-protected via the canonical request's payload-hash line) and,
for presigned URLs, the SigV4 protocol parameters that live in the
query string (X-Amz-Algorithm/Credential/Date/Expires/SignedHeaders/
Signature) in case they are duplicated as headers.
Applies to both header-based and presigned SigV4; non-amz headers are
unaffected.
